Configuration Considerations for Port MAC Security

The following limitations apply to the port MAC security (PMS) feature:

  • Applies only to Ethernet interfaces.
  • PMS is not supported on PVLAN ports.
  • Unknown unicast traffic is flooded out of port with maximum secure MAC learnt on removing the ACL.
  • Not supported on static trunk group members or ports that are configured for link aggregation.
  • Not supported on 802.1X authentication-enabled ports.
  • The SNMP trap generated for restricted MAC addresses indicates the VLAN ID associated with the MAC address, as well as the port number and MAC address.
  • Not supported on ports that have MAC authentication enabled.
  • The first packet from each new secure MAC address is dropped if secure MAC addresses are learned dynamically.
  • Violated MAC movement is not supported.
  • Three MAC addresses must be allocated in port security when connecting IP Phone with PC connected to it. Because, the VOIP phone initially connects untagged. After it gets its configuration and the voice VLAN from FastIron device, it connects tagged with the voice VLAN. The tagged and untagged for the same MAC address are considered as two different entries. Then the PC connected to the phone gets its MAC address registered untagged, consuming a total of three entries.
Parent topic: Port MAC Security Overview